Splunk Search

How to combine the output of 2 different fields into one single field?

snix
Communicator

I have two fields I would like to combine into one field.

  field1      |    field2    |      combined field
1.    Bob                                      Bob
2.                   Jeff                     Jeff
3.                   Jack                     Jack
4.    Frank                                   Frank

Only one field is ever populated at any one time so it is a bit redundant to have two fields that hold very similar information. These should just be combined into a single field.

0 Karma
1 Solution

snix
Communicator

Okay just found the answer on this post:
https://answers.splunk.com/answers/432887/how-to-combine-common-fields-from-search-results-i.html?ut...

This is the line I needed to get the output I am looking for:
eval "New Field Name"=coalesce(field1,field2)

View solution in original post

justinw
Explorer

If you always want the two fields to be combined, and they won't both be populated at once, you could make a field alias to rename field1 as field2 or vice versa. May be a slightly more useful/easy solution if it applies.

0 Karma

snix
Communicator

Okay just found the answer on this post:
https://answers.splunk.com/answers/432887/how-to-combine-common-fields-from-search-results-i.html?ut...

This is the line I needed to get the output I am looking for:
eval "New Field Name"=coalesce(field1,field2)

aaraneta_splunk
Splunk Employee
Splunk Employee

@snix - Glad you found the answer to your question. Please don't forget to "Accept" your answer to resolve this post so that others can easily find it, in case they run into the same type of problem. Thanks.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...